OS Command Injection in Apache Kylin - CVE-2026-108743
Published: October 22, 2026
Vulnerability identifier: #VU157255
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108743
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary operating system commands.
The vulnerability exists due to improper neutralization of special elements in Apache Kylin's Spark job handling when incorporating input into operating system commands. A remote attacker can supply specially crafted input to alter the intended command and execute arbitrary operating system commands.
Affected software
Apache Kylin
How to mitigate CVE-2026-108743
Install security update from vendor's website.
Apache Kylin - update to 5.0.5